Arctic Wolf documents a year-long, highly targeted espionage campaign by the India-nexus threat actor Sloppy Lemming against government and critical infrastructure in Pakistan and Bangladesh, revealing a significant expansion in the group’s capabilities and operational reach. The report highlights deployment of a custom x64 implant, BurrowShell, sophisticated delivery chains, and resilient…
Category: Cyber Security News
Sophos X‑Ops CTU researchers have observed a surge in Iranian hacktivist operations—Operation Epic Fury and Operation Roaring Lion—focused on website defacement, DDoS, and doxxing after coordinated U.S. and Israeli strikes on February 28. Key actors including the Handala Hack Team (linked to COBALT MYSTIQUE), APTIran, and the BaqiyatLock RaaS are claiming…
Researcher Gjoko Krstic reported a high-risk vulnerability in Honeywell’s IQ4 building management controller that can expose its web HMI without authentication in factory-default setups and allow a remote actor to create an administrator account if a user module is not enabled. Honeywell disputes the severity, saying IQ4 devices are delivered unconfigured…
Fig Security announced it has emerged from stealth with $38 million in seed and Series A funding led by Team8 and Ten Eleven Ventures to accelerate product development and market expansion. The company’s platform autonomously maps detection and response pipelines across SIEMs, data lakes, SOAR systems, and AI agents to detect…
Iranian drone strikes damaged three Amazon Web Services data centers in the Middle East, causing structural, power, and water damage and disrupting local services in the UAE and Bahrain. AWS is recovering affected sites and advising customers to migrate workloads to other regions to avoid localized capacity issues. #AmazonWebServices #IranianDroneStrikes…
A hybrid campaign between Iran, the United States, and Israel — labeled Operation Epic Fury by the US and Operation Roaring Lion by Israel — merged kinetic strikes, cyber intrusions, and information operations to severely disrupt Iranian networks and regional infrastructure. The offensive involved state and non-state cyber actors, hacktivists, and…
Google Chrome will move from a four-week to a two-week release cycle starting with Chrome 153 on September 8, delivering two stable releases per month across Desktop, Android, and iOS to speed up feature, bug, and performance updates. Dev and Canary channels will keep their current cadence and Extended Stable will remain on an eight-week cycle for enterprises, while weekly security fixes continue and users should expect more frequent rollouts and occasional restart prompts. #GoogleChrome #CVE-2026-2441
Attackers are abusing legitimate OAuth redirection to bypass email and browser phishing protections, forcing identity providers to redirect users to malicious pages that harvest credentials or deliver malware. Campaigns targeting government and public-sector organizations use lures like e-signature requests and embedded PDFs to trigger silent OAuth errors and redirect victims to phishing frameworks such as EvilProxy or to download chains that culminate in DLL side-loading. #EvilProxy #EntraID
Facebook experienced a worldwide outage that temporarily prevented users from accessing their accounts and presented an “account is currently unavailable” message. The outage began around 4:15 PM ET, impacted related services like the WhatsApp Business API, and was resolved by 6:21 PM ET, although Facebook has not disclosed the cause. #Facebook #Meta
AkzoNobel confirmed a contained security incident at one of its U.S. sites after the Anubis ransomware gang leaked samples claiming to have stolen 170GB of data, including confidential agreements, passport scans, and internal technical documents. The company says the impact is limited, is notifying and supporting impacted parties, and is working with relevant authorities while Anubis continues to post stolen files. #AkzoNobel #AnubisRansomware
CISA added a VMware Aria Operations command-injection flaw (CVE-2026-22719) to its Known Exploited Vulnerabilities catalog and has mandated federal remediation by March 24, 2026. Broadcom and VMware released patches and a temporary workaround script but Broadcom says it cannot independently confirm reports of in-the-wild exploitation. #VMwareAriaOperations #CVE-2026-22719
Google disclosed an actively exploited zero-day memory-corruption vulnerability, CVE-2026-21385, in an open-source Qualcomm display component for Android devices that Qualcomm says affects 234 chipsets and may be under limited, targeted exploitation. Google’s March security update also patched 129 Android defects — the largest single-month total since April 2018 — and both…
Researchers report that the open-source AI security testing platform CyberStrikeAI was observed running on the same IP infrastructure used by the threat actor who breached hundreds of Fortinet FortiGate devices. Team Cymru’s analysis links CyberStrikeAI to automated, AI-driven orchestration that lowers the skill required to perform full attack chains and warns this could accelerate targeting of exposed edge devices. #CyberStrikeAI #FortiGate
Google released March 2026 Android security updates addressing 129 vulnerabilities, including an actively exploited zero-day in a Qualcomm display component (CVE-2026-21385). Qualcomm says the flaw is an integer overflow in the graphics subcomponent affecting 235 chipsets, and Google also patched 10 other critical System, Framework, and Kernel vulnerabilities across two patch levels. #CVE-2026-21385 #Qualcomm
A ransomware gang breached the University of Hawaii Cancer Center’s Epidemiology Division in August 2025, stealing data for nearly 1.2 million individuals. Compromised files included names, Social Security numbers, driver’s license and voter registration records from historical research datasets, prompting UH to notify affected people and pay the attackers for a decryption tool while asserting the incident was isolated to research systems. #UniversityOfHawaii #UHCancerCenter